CVE-2026-24233 is a deserialization of untrusted data vulnerability (CWE-502) in NVIDIA TensorRT-LLM for Linux. The issue exists in the restricted unpickler component responsible for deserializing model weights. An attacker with local access and no authentication can exploit this flaw to cause deserialization of malicious data, which may result in arbitrary code execution, escalation of privileges, tampering with data, and disclosure of sensitive information. The CVSS v3.1 base score is 8.4, indicating high severity. The affected version is explicitly 0.0. There is no vendor-provided patch or official remediation information available at this time.

Successful exploitation allows a local, unauthenticated attacker to execute arbitrary code, escalate privileges, tamper with data, and disclose sensitive information on the affected system running NVIDIA TensorRT-LLM version 0.0. This could compromise system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for any suspicious activity related to TensorRT-LLM usage. Avoid loading untrusted model weights to reduce risk.